Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts
Nitesh Dhanjani's 2015 O'Reilly book Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts is a very practical existence-proof of the inadequacy and urgency of Internet of Things security.
The usual O'Reilly book is a kind of cook-book for accomplishing normal technical tasks, each recipe serving to illustrate broader technical principles. Millions of skilled technical people have followed the steps in O'Reilly books to master Perl and Ruby and Python, become master network administrators, or just master shell scripting.
Abusing the Internet of Things is structured just like one of those cookbooks, only the recipes explain the (relatively simple) steps you need take to compromise everything from a smart lightbulb -- one recipe explains how to plunge a smart lighting system into permanent, irrevocable darkness -- to a smart baby-monitor (this was published months before a family in San Francisco woke to discover a griefer terrorizing their toddler through his bedside monitor) to a smart TV to -- what else? -- a smart car.
In so doing, Dhanjani -- who has presented widely on the subject, including an excellent talk at Black Hat Asia -- illustrates the utter shoddiness of IoT security, and incontrovertibly illustrates the risks from bad information security when every corner of our homes is infiltrated by computers.
But this isn't just a cautionary tale. After walking the reader through a series of examples, complete with source-code and exercises for the student, Dhanjani flips the script, and uses all he's discussed to build a secure, smart doorbell that's connected to the public Internet, with security in it by design. The distance between the approach in this exercise and the approaches taken by the vendors Dhanjani outs as security bumblers is the clincher, the proof that the things you buy are broken because no one cared enough about them to make them hard to break.
Two final chapters sum up the scenarios for future IoT attacks, and dramatize the institutional processes that produce such poor quality devices for our consumption.
The book is written in a spritely, writerly fashion, with many grace notes and interesting case studies -- including an account of how you could use someone's hacked email account to steal their Tesla automobile.
This book is a marvellous thing: an important intervention in the policy debate about information security and a practical text for people trying to improve the situation.
Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts [Nitesh Dhanjani/O'Reilly]
(Image: "Activate the world" (or: what "mobile" really means), Mike, CC-BY)
The fabulous Shelly Bond, former DC Vertigo editor and head honcho, just launched a kickstarter for an anthology called Femme Magnifique that she’s doing in conjunction with Kristy and Brian Miller at HiFi Color.
The Science Fiction Writers of America has released the ballot for this year’s Nebula awards, nominated for and voted upon by the organization’s members; the ballot lists novellas, short stories, novelettes, YA novels (the Andre Norton award), dramatic presentations (the Bradbury award), and novels — including two debut novels I reviewed in 2016: Nisi Shawl’s […]
An excellent excerpt from Aaron Perzanowski and Jason Schultz’s The End of Ownership: Personal Property in the Digital Economy on Motherboard explains how Section 1201 of the 1998 Digital Millennium Copyright Act — which bans tampering with or bypassing DRM, even for legal reasons — has allowed corporations to design their products so that using […]
Making people aware of goods and services in the digital age requires an array of new strategies from social media and email to number-crunching tools like Google Analytics. To get a handle on the techniques used to capture attention and convert traffic into dollars in a crowded online environment, the Full-Stack Marketer Bundle offers 22 hours of training to get […]
Having a luxurious bed isn’t just a fairy tale from a catalog; it is a real, affordable possibility with offerings like this Olive+Owen bedroom set. If you’re thinking of doing some “spring cleaning”, this bed set is an easy way to completely upgrade your room in one purchase.This 20-piece collection has all of the expected slumberland elements, […]
Python is immensely popular in the data science world for the same reason it is in most other areas of computing—it has highly readable syntax and is suitable for anything from short scripts to massive web services. One of its most exciting, newest applications, however, is in machine learning. You can dive into this booming […]